85d9dcb3e03b31222a0d6ec425adfc606fdc333273cbc9dffdb5a50d7c1ca77d

Analysis

max time kernel
27s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 02:12

Target

85d9dcb3e03b31222a0d6ec425adfc606fdc333273cbc9dffdb5a50d7c1ca77d.exe
Size

300KB
MD5

66487a368044c57b06ce12291db9c65b
SHA1

0c13e8a96782c485e8adac32645e93bcb69b1e41
SHA256

85d9dcb3e03b31222a0d6ec425adfc606fdc333273cbc9dffdb5a50d7c1ca77d
SHA512

50b2598b09c36f32869b7a7115522b1e68a6bfcd66d4b94d0be95dffc725811193c29e69d5e8da1c8bde6a3f2123734031adf403639ec8d39cc9ee9a288b0603
SSDEEP

6144:Ky+IeCZca8uF3lGCMwrtm9JYcsIhVr2KEo0gwSqgcWacXvQYjxHLg+lIfJWyy:F+XCL6/j5xr2K4g9FnlYA

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 956 set thread context of 316	956	85d9dcb3e03b31222a0d6ec425adfc606fdc333273cbc9dffdb5a50d7c1ca77d.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 316	956	85d9dcb3e03b31222a0d6ec425adfc606fdc333273cbc9dffdb5a50d7c1ca77d.exe	28
PID 956 wrote to memory of 316	956	85d9dcb3e03b31222a0d6ec425adfc606fdc333273cbc9dffdb5a50d7c1ca77d.exe	28
PID 956 wrote to memory of 316	956	85d9dcb3e03b31222a0d6ec425adfc606fdc333273cbc9dffdb5a50d7c1ca77d.exe	28
PID 956 wrote to memory of 316	956	85d9dcb3e03b31222a0d6ec425adfc606fdc333273cbc9dffdb5a50d7c1ca77d.exe	28
PID 956 wrote to memory of 316	956	85d9dcb3e03b31222a0d6ec425adfc606fdc333273cbc9dffdb5a50d7c1ca77d.exe	28
PID 956 wrote to memory of 316	956	85d9dcb3e03b31222a0d6ec425adfc606fdc333273cbc9dffdb5a50d7c1ca77d.exe	28
PID 956 wrote to memory of 316	956	85d9dcb3e03b31222a0d6ec425adfc606fdc333273cbc9dffdb5a50d7c1ca77d.exe	28
PID 956 wrote to memory of 316	956	85d9dcb3e03b31222a0d6ec425adfc606fdc333273cbc9dffdb5a50d7c1ca77d.exe	28
PID 956 wrote to memory of 316	956	85d9dcb3e03b31222a0d6ec425adfc606fdc333273cbc9dffdb5a50d7c1ca77d.exe	28

C:\Users\Admin\AppData\Local\Temp\85d9dcb3e03b31222a0d6ec425adfc606fdc333273cbc9dffdb5a50d7c1ca77d.exe
"C:\Users\Admin\AppData\Local\Temp\85d9dcb3e03b31222a0d6ec425adfc606fdc333273cbc9dffdb5a50d7c1ca77d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:956
- C:\Users\Admin\AppData\Local\Temp\85d9dcb3e03b31222a0d6ec425adfc606fdc333273cbc9dffdb5a50d7c1ca77d.exe
  "C:\Users\Admin\AppData\Local\Temp\85d9dcb3e03b31222a0d6ec425adfc606fdc333273cbc9dffdb5a50d7c1ca77d.exe"
  2⤵
  PID:316

memory/316-55-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/316-56-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/316-58-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/316-59-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/316-62-0x000000000041758F-mapping.dmp

Download
memory/316-61-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/316-65-0x0000000075891000-0x0000000075893000-memory.dmp

Filesize
8KB

Download
memory/316-66-0x0000000000820000-0x000000000086F000-memory.dmp

Filesize
316KB

Download
memory/316-67-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/316-68-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/956-54-0x0000000000820000-0x000000000086F000-memory.dmp

Filesize
316KB

Download
memory/956-63-0x0000000000820000-0x000000000086F000-memory.dmp

Filesize
316KB

Download